All Topics

vkmanish · ‎12-07-2022

Hi Team, Is there any way to determine the Operating system language before we ingest the logs in Splunk? After ingesting the logs, will correlations work on servers with operating system language...

Hi Team, Is there any way to determine the Operating system language before we ingest the logs in Splunk? After ingesting the logs, will correlations work on servers with operating system languages other than English ? Any alternate option to convert the language into English and get the output in the search head

SanjayReddy · ‎12-07-2022

Hi Team, We have a requirement where we need to run script on remote server based on search condition from Splunk Example, from search results, found that for 10 servers, windows service is dow...

Hi Team, We have a requirement where we need to run script on remote server based on search condition from Splunk Example, from search results, found that for 10 servers, windows service is down, as a part of alert condition Splunk need to login into the remote server and start the service using script wanted to check can this be done?. any leads to related to recourses will be helpful

MK-DRT · ‎12-07-2022

So we're having this issue where all of our active directory events are coming back as having multiple duplicates of the same event. We had an issue with the Service accounts splunk used but all the ...

So we're having this issue where all of our active directory events are coming back as having multiple duplicates of the same event. We had an issue with the Service accounts splunk used but all the domains we want to query can be queried now. Confirmed via ldaptestconnection. But this is specifically happening with searches relating to ldapfilter, below is the search we use, Note : the ldap_doamins.csv contains all the domains we have and what splunk so search. | inputlookup ldap_domains.csv WHERE enabled=1 | fields - enabled | ldapfilter search="(&(memberOf:1.2.840.113556.1.4.1941:=CN=Backup Operators,CN=Builtin,$baseDN$))" domain=$domain$ attrs="name,sAMAccountName,objectCategory,objectClass,objectSID" | tojson | eval _raw = replace(_raw,"^{","{\"query_type\":\"activedirectory:admin_groups\",\"taskid\":\"".now()."\",\"admin_group_dn\":\"CN=Backup Operators,CN=Builtin,".baseDN."\",") | eval _raw = replace(_raw,"\:\[\]",":\"\"") | foreach * [ | eval _raw=replace(_raw,"<<FIELD>>", lower("<<FIELD>>")) ] | fields _raw | collect `activedirectory_index` output_format=hec

avoelk · ‎12-07-2022

Hello, the following search index=index1 message_type=query NOT ([|inputlookup lookup1 | fields ip_address |rename ip_address as dns_request_client_ip]) NOT dns_request_client_ip=127...

Hello, the following search index=index1 message_type=query NOT ([|inputlookup lookup1 | fields ip_address |rename ip_address as dns_request_client_ip]) NOT dns_request_client_ip=127.0.0.1 |stats count by dns_request_client_ip shows me 23300 matched events and shows me a table in statistics with those results. but when I try to use tstats (in that case the datamodel Network_Resolution has all the data for index1) it shows me 0 results, even tho when I only search the tstats datamodel with no other things like lookup etc. it gives me 5 million matches but doesn't show me anything in statistics. also, in job inspector it shows me that the highlighted portion didn't result in any results and the only highlightet part is behind |tstats (in which nothing should be) and it says "NONE |tstats .... " why is this none there? my tstat is as follows: |tstats count as count from datamodel=Network_Resolution where (message_type=query) by dns_request_client_ip and then I try to combine it with the rest of the search as stated above via |search: |search NOT ([|inputlookup lookup1 | fields ip_address |rename ip_address as dns_request_client_ip]) NOT dns_request_client_ip=127.0.0.1 |stats count by dns_request_client_ip there must be something logically wrong with my approach, right? thanks a lot for any help.

jacknguyen · ‎12-07-2022

I get troubleshoot following splunk.doc but it s not working. Anyone have any solutions.

ajayrathore · ‎12-07-2022

Hi, I have a field in the logs like below 2022-12-07T08:40:14.253180536 How can I convert it to splunk time format? I need to eventually select this field in the table...

Hi, I have a field in the logs like below 2022-12-07T08:40:14.253180536 How can I convert it to splunk time format? I need to eventually select this field in the table, so the conversion should work within stats

jcourses · ‎12-07-2022

We've just upgraded to Splunk 9.0.2 and can see IOWAIT is alerting when logging onto the MASTER that the health is red even though CloudWatch is reporting everything is fine and no complaints from th...

We've just upgraded to Splunk 9.0.2 and can see IOWAIT is alerting when logging onto the MASTER that the health is red even though CloudWatch is reporting everything is fine and no complaints from the users. I've spoken to SLT and they are happy for this alert to be disabled. Any ideas?

ojay · ‎12-07-2022

Hi all, is there an existing add-on that I can use for getting HPE iLO data into splunk? I am planning on ingesting it with a universal forwarder from a central server used as a repository. Th...

Hi all, is there an existing add-on that I can use for getting HPE iLO data into splunk? I am planning on ingesting it with a universal forwarder from a central server used as a repository. Thank you, O.

Pratik_murlidha · ‎12-07-2022

Hi, Can we get the license usage summary by application name using API? I’ve tried the license usage with the license ID and account ID but getting the availability of the license as an output. ...

Hi, Can we get the license usage summary by application name using API? I’ve tried the license usage with the license ID and account ID but getting the availability of the license as an output. GET /controller/licensing/v1/usage/license/{licenseId} (http://<host>:<port>/controller/licensing/v1/usage/license/{licenseId} http://<host>:<port>/controller/licensing/v1/usage/account/{accountId}) These APIs are running well but not getting the output I’m looking for. I’m looking for the usage, like how much of the license is consumed in real-time. I appreciate any help you can provide.

whrg · ‎12-07-2022

Hello, I noticed that Splunk automatically translates input labels based on the user's locale. Dashboards with English labels are translated to German when the user locale is de-DE. Here is an ex...

Hello, I noticed that Splunk automatically translates input labels based on the user's locale. Dashboards with English labels are translated to German when the user locale is de-DE. Here is an example: <form version="1.1"> <label>Test</label> <fieldset submitButton="false"> <input type="text" token="From"> <label>From</label> </input> <input type="text" token="To"> <label>To</label> </input> </fieldset> </form> en-US: de-DE: Not only is the translation unwanted, the translation is also wrong. (In this context, "to" should be translated to "für" or "an".) Is it possible to disable this kind of behavior? I found two other posts. The solutions were 1) change each input field individually (https://community.splunk.com/t5/Dashboards-Visualizations/How-to-prevent-translation-of-labels-and-input-fields-in/m-p/537380) and 2) change the user locale to English (https://community.splunk.com/t5/Dashboards-Visualizations/How-to-avoid-translation-on-input-field-in-a-dashboard/td-p/477152). However, I would prefer a global setting to disable automatic translations.

SSwaminathan90 · ‎12-06-2022

Hi Team, Considering the image shared below:- x1 is my x-axis and y1 is my y-axis. I would like to interpolate values for x1, var1 & var2 and not for y1 as shown below: - @interpol...

Hi Team, Considering the image shared below:- x1 is my x-axis and y1 is my y-axis. I would like to interpolate values for x1, var1 & var2 and not for y1 as shown below: - @interpolation, @ scatterplot. Any leads are welcome here

uagraw01 · ‎12-06-2022

Hello Splunkers!! I need the results as per the below format. I have tried some SPL but not achieved with the expected results. Please help me to achieve the same. Order Status AU N...

Hello Splunkers!! I need the results as per the below format. I have tried some SPL but not achieved with the expected results. Please help me to achieve the same. Order Status AU NZ UK 02:00:00 created. 10 11 12 released 9 8 6 shipped 6 7 4 AU NZ UK 03:00:00 created. 10 11 12 released 9 8 6 shipped 6 7 4 What I have done so far In SPL : index="ABC "OrderStatus=created" OR "OrderStatus=Shipped" OR "OrderStatus=Released" OR "OrderStatus=Cancelled" | rex field=_raw "SellerOrganizationCode\=one\_(?<Market>[A-Z]{2})" | search NOT (Market="CA" OR Market="US" OR Market="KO" OR Market="SE" OR Market="NL" OR Market="IE" OR Market="NO" OR Market="LA") | replace CH WITH EU GB WITH UK | bin _time span=1h | eval Time=strftime(_time,"%m/%d-%y %H:%M:%S.%Q %p") | eval newtime=strptime(Time,"%m/%d-%y %H:%M:%S.%Q %p") | eval Time_Hour=strftime(newtime,"%m/%d/%Y %H:%M") | chart count by Time_Hour,Market usenull=f | addtotals col=true row=true label=Total labelfield=Time_Hour | rename Total as "Total orders for the hour"

wangkevin1029 · ‎12-06-2022

Hi, Splunkers, I have dashboard ,which has a table ouput like below: | table _time, column1, column2, column3 time column1 column2 column3 xxx a 1234 ...

Hi, Splunkers, I have dashboard ,which has a table ouput like below: | table _time, column1, column2, column3 time column1 column2 column3 xxx a 1234 1234 xxx b 3243 3434 xxx c 2343 3434 xxx a 1234 1234 xxx b 3243 3434 xxx a 2343 3434 when I add |stats count by column1: | table column1, column2, column3 | stats count by column1 column1 count a 3 b 2 c 1 I want to have a chart to display this stats count result in different time period, when I select different time/date range, like when I select 7 days, I want this stats count columns1 result showing in every single hour for each day for 7 days date range I selected. I am a splunk beginner, not sure if I describe my requirement clearly... thx in advance. Kevin

splunkis0927 · ‎12-06-2022

I have a issue: On one of my UF, The indexing time of all the logs (including the internal logs) get delayed for 2-3mins, and This delay occurs every 30mins. other UFs looks ok. we have checked t...

I have a issue: On one of my UF, The indexing time of all the logs (including the internal logs) get delayed for 2-3mins, and This delay occurs every 30mins. other UFs looks ok. we have checked the queue on this UF is not blocked. we have changed [thruput]maxKBps = 0 But the indexing time issue is still there. Can anyone please help with this issue ? Do we need to check more configs or logs? When indexing time get delayed I can see logs below: [logs]: INFO Watchdog - No response received from IMonitoredThread=0xxxxxxxxx within elapsed=8000 ms. Looks like thread_name="TcpOutEloop" thread_id=1xxxx is busy !? Starting to trace with timeout=8000 ms interval. INFO Watchdog - Stopping trace. Response for IMonitoredThread ptr=0xxxxxxxxx - thread_name="TcpOutEloop" thread_id=1xxxx - finally received after 3xxxx ms (estimation only). INFO HealthChangeReporter - feature="Ingestion Latency" indicator="ingestion_latency_lag_sec" previous_color=green color=yellow due_to_threshold_value=15 measured_value=30 reason="Events from tracker.log are delayed for 30 seconds, which is more than the yellow threshold (15 seconds). This typically occurs when indexing or forwarding are falling behind or are blocked." Possible is the UF being used to monitor too many files at the same time? so , make thread name='TcpOutEloop' busy ?

Vani_26 · ‎12-06-2022

below query: index=app_mnt_apl source=xxxx note: here the CustomerApp Details: Countywise or CustomerApp Details: Worldwise or CustomerApp Details: Areawise are not in interested fields. ...

below query: index=app_mnt_apl source=xxxx note: here the CustomerApp Details: Countywise or CustomerApp Details: Worldwise or CustomerApp Details: Areawise are not in interested fields. Sample logs: 2022-11-12 15:12:27,678 [hanper risk-100] h.t.i.l.g. applicationreportanalysis [565677nmnm7676] - [THY-j767676] - [thy-application_THY] - CustomerApp Details: Countywise 2022-11-12 15:12:27,678 [hanper risk-100] h.t.i.l.g. applicationreportanalysis [565677nmnm7676] - [THY-j767676] - [thy-application_THY] - CustomerApp Details: Worldwise 2022-11-12 15:12:27,678 [hanper risk-100] h.t.i.l.g. applicationreportanalysis [565677nmnm7676] - [THY-j767676] - [thy-application_THY] - CustomerApp Details: Areawise 2022-11-12 15:12:27,678 [hanper risk-100] h.t.i.l.g. applicationreportanalysis [565677nmnm7676] - [THY-j767676] - [thy-application_THY] - CustomerApp Details: Countywise 2022-11-12 15:12:27,678 [hanper risk-100] h.t.i.l.g. applicationreportanalysis [565677nmnm7676] - [THY-j767676] - [thy-application_THY] - CustomerApp Details: Worldwise 2022-11-12 15:12:27,678 [hanper risk-100] h.t.i.l.g. applicationreportanalysis [565677nmnm7676] - [THY-j767676] - [thy-application_THY] - CustomerApp Details: Areawise I want to represent CustomerApp Details: Areawise, Worldwise and countrywise in a form of a pie chart. how to frame the query to get this???

bt149 · ‎12-06-2022

I have a log file that is coming into splunk in json format. There appear to be two fields of interest, "key" and "value." key: originid origintype template starttime endtime justification...

I have a log file that is coming into splunk in json format. There appear to be two fields of interest, "key" and "value." key: originid origintype template starttime endtime justification value - (has the values for each of the items in "key."): 12345 (is not always the same id) BuiltInRole (is not always the same) 85750845e54 (is not always the same) 2022-12-03T14:00:00:00.5661018Z 2022-12-04T14:00:00:00.5661018Z some reason to satisfy the justification I want have the following: originid = 12345 origintype = BuiltInRole template = 85750845e54 starttime = 2022-12-03T14:00:00:00.5661018Z endtime = 2022-12-04T14:00:00:00.5661018Z justification = some reason to satisfy the justification Thanks for the help and guidance.

splunkuser320 · ‎12-06-2022

I need to show only the results of the job. Job try multiple times in case of failure. So if the job passed on 3rd attempt then I do not want to include it in the failed job counter. Sample logs ...

I need to show only the results of the job. Job try multiple times in case of failure. So if the job passed on 3rd attempt then I do not want to include it in the failed job counter. Sample logs {"id":"1", "status": "Failed","retry":"1"} {"id":"1", "status": "Failed","retry":"2"} {"id":"1", "status": "Failed","retry":"4"} {"id":"1", "status": "Failed","retry":"5"} {"id":"2", "status": "Passed","retry":"1"} {"id":"3", "status": "Failed","retry":"1"} {"id":"3", "status": "Passed","retry":"1"} In the above example counter should show value 0f 1 since only job 1 is failed in last try

creiglow · ‎12-06-2022

In the documentation at https://docs.splunk.com/Documentation/ES/7.0.2/Admin/Changethreatintel under Review the logic for retention the document states, "The threat retention input runs every 24 ...

In the documentation at https://docs.splunk.com/Documentation/ES/7.0.2/Admin/Changethreatintel under Review the logic for retention the document states, "The threat retention input runs every 24 hours by default" If it runs every 24 hours by default, how do you change that behavior? What process/search/whatever runs the threat retention input? Where is it defined? Can it be run manually? Thanks, --Keith

catdadof3 · ‎12-06-2022

Hi all, I have a dashboard that has a single value panel. I am trying to make a dynamic panel that will change with the data. I need to display the result number in the panel, but the coloring nee...

Hi all, I have a dashboard that has a single value panel. I am trying to make a dynamic panel that will change with the data. I need to display the result number in the panel, but the coloring needs to be dependent on another number. Example data: Total Sandwiches Made Name Cheese Ham PB Turkey sum marker topTh Total 1110 270 110 710 Total 2 110 2200 Bill 400 100 20 600 2 110 1120 Pam 700 120 80 100 2 110 1000 Finn 10 50 10 10 1 110 80 And the example SPL: index=food sourcetype=sandwiches | stats sum(Cheese) as Cheese sum(Ham) as Ham sum(PB) as PB sum(Turkey) as Turkey by Name | addtotals row=t col=t labelfield="sum" | eval topTh=case(sum="Total", (Total*.05), 1=1, null()) | sort topTh | filldown topTh | eval marker=if(Total>=topTh, 2,1) Basically, if the marker is 1, I'd like the color of the number to be one color and a different one for 2 while still displaying the 'Total' field. I have the options as this: <option name="colorBy">value</option> <option name="drilldown">all</option> <option name="field">Total</option> <option name="rangeColors">["0x53A051","0xeb5654"]</option> <option name="rangeValues">[$lowerThresh$,$upperThresh$]</option> <option name="refresh.display">none</option> <option name="useColors">1</option> and additional logic above it: <done> <condition match="'result.marker'==2"> <set token="lowerThresh">1</set> <set token="upperThresh">2</set> </condition> </done> Any help would be greatly appreciated.

donfarland · ‎12-06-2022

I have a simple tstats based query that looks for how many hosts have checked in over a period of time and then displays it as a single value visualization on a dashboard. The query and visualization...

I have a simple tstats based query that looks for how many hosts have checked in over a period of time and then displays it as a single value visualization on a dashboard. The query and visualization work perfectly, but I was trying to figure out if I can get the trend indicator and the trendline to use different intervals. | tstats dc(host) WHERE index="$site$" earliest=-14d@d latest=@d by _time span=7d Currently, the visualization will show: Value: The # of hosts that reported in over the past 7 days. Trend Indicator: The difference between the last 7 days and the previous 7-day period. Trendline: A simple line with two points showing that difference. Ideally, I'd like to be able to define a 1d interval for the trendline to communicate to the user when the increases/decreases occurred.

All Topics

All Topics

How to determine the Operating system language?

Is it possible to run a Script From Splunk on Remote Server?

Active Directory Returning duplicated events?

Search Job Investigation after search with no results shows "None"?

Why does ITSI Service Analyzer not show anything?

How can I convert it to splunk time format?

How to disable IOWAIT?

What add-on can I use for integration of HPE iLO logs?

AppDynamics License usage by application name

How to prevent automatic translation of input labels?

How can I make interpolation between given two points in Splunk, where time variable is not involved?

Help with SPL for report generation?

How to create timechart for a stat count result for every single hour for date range selection?

Why do the indexing time of all UF logs gets delayed, including the internal logs (This delay occurs every 30mins)?

How to frame this Pie chart- Dashboard panel?

How to search spath field and value pairs?

How to get only latest try of a job?

How can I change Threat intelligence setting the default time that the removal process runs for threat sources?

Variable range values with a token?

Defining different intervals for the Trend & Sparkline indicators on a single value visualization.

All Topics

Are you a member of the Splunk Community?

All Topics